He signed no NDA to prohibit him from talking about the project. And according to their story, it doesn’t sound like they actively opened or read secret documents, it was all supposedly relayed to them by the employees themselves.
Again, the threat isn’t this leaker. The threat is poor security, negligent employees…